CVE-2021-41773

CVE-2021-41773 Playground This is a small Docker recipe for setting up a Debian bookworm based container with an instance of the Apache HTTPd 2.4.49 that is vulnerable to CVE-2021-41773. CGI has been explicitly enabled so it can be used to test/verify Local file Disclosure behavior as well as...

Güralp MAN-EAM-0003 3.2.4 - XML External Entity (XXE)

cgi-bin/xmlstatus.cgi in Güralp MAN-EAM-0003 3.2.4 is vulnerable to an XML External Entity XXE issue via XML file upload, which leads to local file disclosure. id: CVE-2022-38840 info: name: Güralp MAN-EAM-0003 3.2.4 - XML External Entity XXE author: daffainfo severity: high description: |...

Gotenberg < 8.34.0 - Local File Disclosure

Gotenberg before 8.34.0 allows SSRF and limited local file disclosure via its /forms/libreoffice/convert endpoint. When LibreOffice is used to convert user-uploaded DOCX files, external relationships within the document such as a:blip r:link TargetMode="External" can instruct LibreOffice to fetch...

Cellinx NVT Web Server - Local File Disclosure

Cellinx NVT v1.0.6.002b was discovered to contain a local file disclosure vulnerability via the component /cgi-bin/GetFileContent.cgi. id: CVE-2023-23063 info: name: Cellinx NVT Web Server - Local File Disclosure author: daffainfo severity: high description: | Cellinx NVT v1.0.6.002b was discover...

CVE-2017-10617

CVE-2017-10616 & CVE-2017-10617 These two vulnerabilities affect Juniper Contrail version 2.2, 3.0, 3.1 and 3.2: Hard coded credentials CVE-2017-10616 XML External Entity CVE-2017-10617 Vendor security bulletin can be found at Juniper Security Alert JSA10819 2017-10. The vulnerable service in...

CVE-2022-44268-ImageMagick-Vulnerable-Docker-Environment

CVE-2022-44268 Lectura Arbitraria de Archivos Locales de ImageMagick https://www.metabaseq.com/imagemagick-zero-days/ Basado en el PoC CVE-2022-44268 ImageMagick Arbitrary File Read PoC, creé un entorno de prueba de vulnerabilidades usando docker. Uso get image docker pull...

CVE-2026-102155

An XML External Entity XXE injection vulnerability in the WiFi-server Spectralight application allows any authenticated user to send malicious requests, leading to arbitrary local file disclosure and partial denial of service...

CVE-2026-102155

The WiFi-server Spectralight application is susceptible to an XML External Entity (XXE) injection vulnerability. This flaw allows any authenticated user to submit malicious requests, which can result in arbitrary local file disclosure and a partial denial of service . While the vulnerability's te...

CVE-2026-102155 Security Advisory 0190

An XML External Entity XXE injection vulnerability in the WiFi-server Spectralight application allows any authenticated user to send malicious requests, leading to arbitrary local file disclosure and partial denial of service...

EUVD-2026-93953

An XML External Entity XXE injection vulnerability in the WiFi-server Spectralight application allows any authenticated user to send malicious requests, leading to arbitrary local file disclosure and partial denial of service...

CVE-2026-102155 Security Advisory 0190

An XML External Entity XXE injection vulnerability in the WiFi-server Spectralight application allows any authenticated user to send malicious requests, leading to arbitrary local file disclosure and partial denial of service...

Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode

Summary When the HTML backend renders pages in a headless browser HTMLBackendOptionsrenderpage=True, the enablelocalfetch option is not enforced. A crafted HTML file can embed an arbitrary local file for example with , and that file's contents appear in the page image attached to the returned...

EUVD-2026-92814

Docling: enablelocalfetch is not enforced in HTML browser-rendering mode...

CVE-2026-105750

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.82.0 until 2.118.1, HTMLBackendOptionsrenderpage=True permits file URLs because HTMLDocumentBackend.getbrowserrequestblockreason does not enforce the...

CVE-2026-105750 Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.82.0 until 2.118.1, HTMLBackendOptionsrenderpage=True permits file URLs because HTMLDocumentBackend.getbrowserrequestblockreason does not enforce the...

CVE-2026-105748 Docling: Crafted DoclingDocument JSON embeds local image files into converted output

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.16.0 until 2.131.0, the InputFormat.JSONDOCLING backend in docling/backend/json/doclingjsonbackend.py validates serialized DoclingDocument input without rejecting...

CVE-2026-105748 Docling: Crafted DoclingDocument JSON embeds local image files into converted output

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.16.0 until 2.131.0, the InputFormat.JSONDOCLING backend in docling/backend/json/doclingjsonbackend.py validates serialized DoclingDocument input without rejecting...

CVE-2021-41773

CVE-2021-41773 Playground This is a small Docker recipe for setting up a Debian bookworm based container with an instance of the Apache HTTPd 2.4.49 that is vulnerable to CVE-2021-41773. CGI has been explicitly enabled so it can be used to test/verify Local file Disclosure behavior as well as...

CVE-2022-24716-2

CVE-2022-24716 Icinga Web 2 is an open source monitoring web interface, framework and command line interface. Unauthenticated users can leak the contents of user-accessible local system files from the web server, including icingaweb2 configuration files with database credentials. Installation Usa...

[SECURITY] [DLA 4815-1] freecad security update

Debian LTS Advisory DLA-4815-1 [email protected] https://www.debian.org/lts/security/ Tobias Frost October 03, 2026 https://wiki.debian.org/LTS Package : freecad Version : 0.20.2+dfsg1-4+deb12u1 CVE ID : CVE-2026-34789 CVE-2026-73234 CVE-2026-73235 Debian Bug : 1144349 Three...